# This workflow uses actions that are not certified by GitHub.
# They are provided by a third-party and are governed by
# separate terms of service, privacy policy, and support
# documentation.

# This workflow lets you compile your Go project using a SLSA3 compliant builder. 
# This workflow will generate a so-called "provenance" file describing the steps 
# that were performed to generate the final binary.
# The project is an initiative of the OpenSSF (openssf.org) and is developed at 
# https://github.com/slsa-framework/slsa-github-generator.
# The provenance file can be verified using https://github.com/slsa-framework/slsa-verifier.
# For more information about SLSA and how it improves the supply-chain, visit slsa.dev.

name: SLSA generic generator
on:
  workflow_dispatch:
  release:
    types: [created]

permissions: read-all

jobs:
  build:
    outputs:
      digests: ${{ steps.hash.outputs.digests }}

    steps:
      # ========================================================
      #
      # Step 1: Build your artifacts.
      #
      # ========================================================      
      - name: Build artifacts
        run: |
            # These are some amazing artifacts.
            echo "artifact1" > artifact1
            echo "artifact2" > artifact2

      # ========================================================
      #
      # Step 2: Add a step to generate the provenance subjects
      #         as shown below. Update the sha256 sum arguments
      #         to include all binaries that you generate
      #         provenance for.
      #
      # ========================================================
      - name: Generate subject
        id: hash
        run: |
          set -euo pipefail

          echo "::set-output name=digests::$(sha256sum artifact1 artifact2 | base64 -w0)"

  provenance:
    needs: [build]
    permissions:
      actions: read
      id-token: write
      contents: read
    uses: slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml@v1.2.0
    with:
      base64-subjects: "${{ needs.build.outputs.digests }}"
      upload-assets: true # Optional: Upload to a new release